CVE-2026-68197wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper mwifiex_tdls_add_ht_oper() gates its follow-the-AP-bandwidth path on bss_desc->bcn_ht_cap being present, but then dereferences a different pointer, bss_desc->bcn_ht_oper: if (ISSUPP_CHANWIDTH40(priv->adapter->hw_dot_11n_dev_cap) && bss_desc->bcn_ht_cap && ISALLOWED_CHANWIDTH40(bss_desc->bcn_ht_oper->ht_param)) bcn_ht_cap and bcn_ht_oper are populated independently while parsing the associated AP's beacon in mwifiex_update_bss_desc_with_ie(): an AP that advertises an HT Capabilities element but no HT Operation element leaves bcn_ht_cap non-NULL and bcn_ht_oper NULL. Setting up a TDLS link to a peer while associated to such an AP then dereferences the NULL bcn_ht_oper and crashes the kernel. Every other bcn_ht_oper user in the driver NULL-checks it first. Guard on the pointer that is actually dereferenced. Found by 0sec automated security-research tooling (https://0sec.ai).
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 396939f94084d5923d558e9f22db48bc51156e47 before e1770f7410b4232a0267924f99751dc9c5ca31af; 396939f94084d5923d558e9f22db48bc51156e47 builds before 8c2058717fd06f05d421c2d3adf1dff3c3abcda1; from 396939f94084d5923d558e9f22db48bc51156e47 before fba7eb7b248ea0618235f504158b685d752a153a; from 396939f94084d5923d558e9f22db48bc51156e47 before eb42c3c8fd479166c42984728754cd779c71fd60; 396939f94084d5923d558e9f22db48bc51156e47 builds before 45011e4d9ba3f2182e5df64be65888044fa20771; 396939f94084d5923d558e9f22db48bc51156e47 builds before 9375a4ea4121625ef27a46b74781cda66a5cc61b; from 396939f94084d5923d558e9f22db48bc51156e47 before cca4398aa305c22016d1714f388e2fa6ea4e5ad4; from 396939f94084d5923d558e9f22db48bc51156e47 before c3d68e294cbb6a4090bb219d3dcaca85a011809b | CNA record |
References
- https://git.kernel.org/stable/c/e1770f7410b4232a0267924f99751dc9c5ca31af
- https://git.kernel.org/stable/c/8c2058717fd06f05d421c2d3adf1dff3c3abcda1
- https://git.kernel.org/stable/c/fba7eb7b248ea0618235f504158b685d752a153a
- https://git.kernel.org/stable/c/eb42c3c8fd479166c42984728754cd779c71fd60
- https://git.kernel.org/stable/c/45011e4d9ba3f2182e5df64be65888044fa20771
- https://git.kernel.org/stable/c/9375a4ea4121625ef27a46b74781cda66a5cc61b
- https://git.kernel.org/stable/c/cca4398aa305c22016d1714f388e2fa6ea4e5ad4
- https://git.kernel.org/stable/c/c3d68e294cbb6a4090bb219d3dcaca85a011809b
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.